@kernhq/module-inventory 0.2.0 → 0.4.0

package/dist/server/jobs.js

@@ -0,0 +1,358 @@
+import { and, asc, eq, inArray, isNull, sql } from 'drizzle-orm';
+import { MODULE_ID } from '../contract/models.js';
+import { InventorySettings } from '../contract/settings.js';
+import { assets, repairs, workspaces } from './schema.js';
+import { membersWithPermission } from './services/audience.js';
+import { inventoryServices } from './services/index.js';
+import { assetUrl } from './services/search.js';
+/** More rows than any one workspace should reach in a day, and a bound all the same. */
+const SWEEP_LIMIT = 500;
+/**
+ * Inventory's scheduled work.
+ *
+ * **A cron expression fires in UTC, and this module's users do not live there** — `module-hr` says
+ * that at the top of its own jobs file, and it is worth saying what follows from it here, because
+ * the answer is different. HR's calendar jobs fan out per office and ask each whether *that
+ * office's* local boundary has passed, since which month an accrual belongs to changes with the
+ * answer. Nothing here has that property:
+ *
+ * - what these two sweeps *find* is a date comparison against a window thirty days or a fortnight
+ *   wide, so an item is inside it for weeks and the hour it is noticed cannot change whether it is
+ *   noticed;
+ * - what they *send* is sent exactly once per row ever, because each writes a marker column, so
+ *   firing on a different hour cannot send anything twice.
+ *
+ * So a daily UTC cron is honest here where it would have been a bug in HR. The one thing that must
+ * not be borrowed from the deployment is **today**: `now()::date` in Postgres is the database
+ * session's timezone, which is an accident of how the container was started. Today comes from
+ * `todayUtc()` below and is passed into the query as a value.
+ *
+ * Both handlers are idempotent by construction rather than by scheduling: a retried run re-reads the
+ * marker and finds nothing left to say. That matters, because pg-boss retries a throwing handler
+ * three times.
+ */
+/** Today, as this module means it: the UTC date. The same clock `RepairService` dates a repair by. */
+const todayUtc = (at = new Date()) => at.toISOString().slice(0, 10);
+/** `YYYY-MM-DD`, `n` days either side. */
+function shiftDays(date, days) {
+    const d = new Date(`${date}T00:00:00Z`);
+    d.setUTCDate(d.getUTCDate() + days);
+    return d.toISOString().slice(0, 10);
+}
+/**
+ * Workspaces this module is switched on in.
+ *
+ * Read from the module's own table rather than asked of core every tick, for the reason
+ * `schema.ts` gives at `workspaces`: a sweep that depends on a broker round trip fails whenever
+ * core is briefly away, which is exactly the condition an unattended overnight job has to survive.
+ *
+ * **Unbound on purpose, and the table's policy is what makes that legal.** A scheduler is woken by a
+ * clock, so there is no workspace to bind to and `app.workspace_id` is unset here by definition. The
+ * per-workspace policy every tenant table carries therefore matches nothing, and `workspaces` — like
+ * every other table in this schema — carries `force row level security`, which subjects the schema's
+ * **owner** to its policies as well. So this read answered *zero rows, silently, for ever* on any
+ * deployment whose application role is not a superuser, and it would have gone on doing so with no
+ * error to notice. `0006_workspace_registry_read.sql` adds the one policy that admits it: a select
+ * policy on this table alone, for a session with no workspace bound. It is exported so the test
+ * suite can run the real enumeration rather than a query that resembles it.
+ */
+export async function activeWorkspaces(kernel) {
+    const rows = await kernel.database.db.select({ id: workspaces.workspaceId }).from(workspaces);
+    return rows.map((row) => row.id);
+}
+/**
+ * Run `fn` for every workspace that still has the module on, logging per-workspace failures rather
+ * than propagating them.
+ *
+ * One workspace's bad data must not stop the sweep for the next one — a job that throws half way
+ * through is a job that has notified an arbitrary prefix of the instance and will do it again on the
+ * retry. `isModuleEnabled` is asked because the row here outlives a workspace switching the module
+ * off: nothing deletes it, deliberately, so switching Inventory back on does not lose the
+ * registration.
+ */
+async function forEachWorkspace(kernel, job, fn) {
+    for (const workspaceId of await activeWorkspaces(kernel)) {
+        if (!(await kernel.isModuleEnabled(workspaceId, MODULE_ID).catch(() => false)))
+            continue;
+        try {
+            await fn(workspaceId);
+        }
+        catch (err) {
+            kernel.log.warn({ err: err instanceof Error ? err.message : String(err), workspaceId, job, module: MODULE_ID }, 'inventory: scheduled job failed for a workspace');
+        }
+    }
+}
+/**
+ * The three statuses this module derives, and therefore the only three it may overwrite.
+ *
+ * `reserved`, `lost` and `retired` are set by hand by features that do not exist yet — nothing
+ * writes them today — and a reconciliation that stamped over one would silently undo somebody's
+ * decision. `deriveStatus` says the same thing from the other side.
+ */
+const DERIVED_STATUSES = ['in_stock', 'assigned', 'under_repair'];
+/**
+ * Bring `assets.status` back into step with the facts, for one workspace.
+ *
+ * **Every write path already does this for the row it touches, and this is for the rows nobody
+ * touches.** `status` is stored because every list filter asks for it, and derived from two facts —
+ * custody, and an open repair *the workspace still records*. The second one has an input that no
+ * row change can be hung off: switching the `repairs` capability off changes the answer for every
+ * asset in the workspace at once, and switching it back on changes it back, without a single row
+ * being written either time.
+ *
+ * That is what stranded an asset. With repairs off, `repairs.complete` answers 404 and the row that
+ * decides `under_repair` can never be closed, so an item sat in a status nothing could move it out
+ * of, behind an archive that refused it for pointing at the same 404. The refusal is withdrawn now
+ * and every custody verb re-derives the status it writes — so anything anybody touches heals at
+ * once — and this is the sweep for the spare in the cupboard that nobody touches for a month.
+ *
+ * It runs **in both directions and on every tick**, which is what makes the capability reversible
+ * rather than one-way: with repairs off it releases anything still stamped `under_repair`, and with
+ * repairs on it stamps back anything that has an open repair and lost the status while the switch
+ * was off. Nothing is destroyed either way — the repair rows are untouched, and the status is a
+ * derivation, not a record.
+ *
+ * One statement, and normally it matches nothing: the `is distinct from` is what keeps a nightly
+ * job over every workspace from rewriting every asset row it has. Live rows only — an archived
+ * asset is out of the register, and churning its `updated_at` would say something moved.
+ */
+export async function reconcileStatuses(kernel, workspaceId, repairsOn) {
+    // Correlated to the asset row being updated. Skipped entirely when the workspace does not record
+    // repairs, which is the whole point — the same shape as `awayForRepair` in `status.ts`, expressed
+    // once over a set instead of once per row.
+    const away = repairsOn
+        ? sql `exists (select 1 from ${repairs}
+                   where ${repairs.workspaceId} = ${assets.workspaceId}
+                     and ${repairs.assetId} = ${assets.id}
+                     and ${repairs.returnedOn} is null)`
+        : sql `false`;
+    const derived = sql `case
+      when ${away} then 'under_repair'
+      when ${assets.custodianUserId} is not null then 'assigned'
+      else 'in_stock' end`;
+    const rows = await kernel.database.withWorkspace(workspaceId, (tx) => tx
+        .update(assets)
+        .set({ status: derived, updatedAt: new Date() })
+        .where(and(eq(assets.workspaceId, workspaceId), isNull(assets.archivedAt), inArray(assets.status, [...DERIVED_STATUSES]), sql `${assets.status} is distinct from (${derived})`))
+        .returning({ id: assets.id }));
+    return rows.length;
+}
+/** A `date` column reads back as `YYYY-MM-DD`; this is how it is spoken in a sentence. */
+const readableDate = (date) => new Date(`${date}T00:00:00Z`).toLocaleDateString('en-GB', {
+    day: 'numeric',
+    month: 'short',
+    year: 'numeric',
+    timeZone: 'UTC',
+});
+export function inventoryJobs() {
+    return [
+        {
+            /**
+             * Warranties about to run out.
+             *
+             * Told to whoever is holding the item, because they are the person who will be standing in
+             * front of a broken laptop the week after — and to whoever may replace it when nobody is
+             * holding it, since a spare in a cupboard has no other audience. One notice per asset, ever:
+             * `warranty_notified_at` is what stops a thirty-day window sending thirty emails, and
+             * `assets.update` clears it when the date itself moves.
+             */
+            name: 'warranty-sweep',
+            cron: '0 7 * * *',
+            handler: async (_input, { kernel }) => {
+                const svc = inventoryServices(kernel);
+                await forEachWorkspace(kernel, 'warranty-sweep', async (workspaceId) => {
+                    // Settings come from core over the broker, so they are read before any transaction opens
+                    // — the same rule `AssetService.codeFormat` documents.
+                    const settings = await kernel.settings.module(workspaceId, MODULE_ID, InventorySettings);
+                    const today = todayUtc();
+                    const horizon = shiftDays(today, settings.warrantyNoticeDays);
+                    const due = await kernel.database.withWorkspace(workspaceId, (tx) => tx
+                        .select({
+                        id: assets.id,
+                        code: assets.code,
+                        name: assets.name,
+                        warrantyUntil: assets.warrantyUntil,
+                        custodianUserId: assets.custodianUserId,
+                    })
+                        .from(assets)
+                        .where(and(eq(assets.workspaceId, workspaceId), isNull(assets.archivedAt), isNull(assets.warrantyNotifiedAt), 
+                    // Inside the window and not already past it. An expiry that came and went is not
+                    // "about to run out", and saying so weeks later reads as a broken clock.
+                    sql `${assets.warrantyUntil} is not null
+                      and ${assets.warrantyUntil} >= ${today}::date
+                      and ${assets.warrantyUntil} <= ${horizon}::date`))
+                        .orderBy(asc(assets.warrantyUntil))
+                        .limit(SWEEP_LIMIT));
+                    if (!due.length)
+                        return;
+                    // Resolved once for the workspace rather than once per asset: it is a handful of broker
+                    // calls, and a hundred expiring warranties must not become a hundred audience lookups.
+                    let managers = null;
+                    const fallback = async () => {
+                        managers ??= await membersWithPermission(kernel, workspaceId, 'inventory.asset.manage');
+                        return managers;
+                    };
+                    let notified = 0;
+                    let unheard = 0;
+                    let undelivered = 0;
+                    for (const asset of due) {
+                        const userIds = asset.custodianUserId ? [asset.custodianUserId] : await fallback();
+                        /**
+                         * Nobody to tell is **not** the same as told, so the row is left unmarked.
+                         *
+                         * Marking it anyway would mean a workspace that has nobody holding
+                         * `inventory.asset.manage` today silently loses the notice for ever — including for the
+                         * person who is given that permission tomorrow. The cost of leaving it is one audience
+                         * lookup per workspace per night, which is already resolved once and cached above.
+                         */
+                        if (!userIds.length) {
+                            unheard++;
+                            continue;
+                        }
+                        const delivered = await svc.notify.notify({
+                            workspaceId,
+                            userIds,
+                            type: 'inventory.warranty.expiring',
+                            // The tag leads, because that is what is printed on the sticker.
+                            title: `${asset.code} is out of warranty on ${readableDate(asset.warrantyUntil)}`,
+                            body: asset.name,
+                            object: { module: MODULE_ID, type: 'asset', id: asset.id },
+                            url: assetUrl(asset.id),
+                            groupKey: asset.id,
+                        });
+                        /**
+                         * **The marker means "everybody was told", so nothing is marked until everybody was.**
+                         *
+                         * `notify` is best-effort by design: a `core.notifications.create` that fails is logged
+                         * and swallowed, and it used to come back looking exactly like one that succeeded. This
+                         * column is written once per asset and never cleared, and the notice is sent once per
+                         * asset ever — so a marker written over a swallowed failure is not a delayed notice, it
+                         * is a notice nobody will ever receive, for the life of the row. Left unmarked the
+                         * sweep simply says it again tomorrow, which is the whole reason it runs every day.
+                         *
+                         * **A partial delivery is a failure, and it used to be recorded as a success.** A spare
+                         * with three managers in the audience needed one of the three writes to land for the row
+                         * to be stamped *told*; the other two were never told and never would be. There is one
+                         * column and it cannot hold two answers, so it holds the pessimistic one — whoever did
+                         * hear it hears it again tomorrow, `groupKey` collapses that where a client groups, and
+                         * nobody is silently left out.
+                         */
+                        if (delivered.delivered < delivered.targeted || !delivered.targeted) {
+                            undelivered++;
+                            continue;
+                        }
+                        await kernel.database.withWorkspace(workspaceId, (tx) => tx
+                            .update(assets)
+                            .set({ warrantyNotifiedAt: new Date() })
+                            .where(and(eq(assets.workspaceId, workspaceId), eq(assets.id, asset.id))));
+                        notified++;
+                    }
+                    if (unheard)
+                        kernel.log.warn({ module: MODULE_ID, workspaceId, silent: unheard }, 'inventory: warranties are running out and nobody in the workspace may replace them');
+                    if (undelivered)
+                        kernel.log.warn({ module: MODULE_ID, workspaceId, undelivered }, 'inventory: warranty notices could not be delivered; they stay unmarked and go again tomorrow');
+                    if (notified)
+                        kernel.log.info({ module: MODULE_ID, workspaceId, notified }, 'inventory: warranties about to expire');
+                });
+            },
+        },
+        {
+            /**
+             * Repairs nobody has chased.
+             *
+             * Told to the person who logged it — they committed the company to the money and they have the
+             * repairer's number — and to whoever is still holding the item, who is the one waiting for it
+             * back. Neither is a guess: both are columns. Only when the repair carries neither does this
+             * fall back to asking who may manage repairs at all.
+             *
+             * **Asks the capability first, and acts on the answer either way.** A workspace with `repairs`
+             * switched off has no repairs surface, so a sweep that notified about repair rows left over
+             * from before it was switched off would be the feature answering 404 to a person and sending
+             * them email about it. What it *does* still owe that workspace is a register that does not
+             * claim `under_repair` for an item behind a procedure that answers 404 — so the status
+             * reconciliation runs before the switch is consulted, in both directions. `reconcileStatuses`
+             * argues it in full.
+             */
+            name: 'repair-overdue',
+            cron: '20 7 * * *',
+            handler: async (_input, { kernel }) => {
+                const svc = inventoryServices(kernel);
+                await forEachWorkspace(kernel, 'repair-overdue', async (workspaceId) => {
+                    const on = await kernel.capabilities(workspaceId, MODULE_ID);
+                    const repairsOn = on.has('repairs');
+                    const healed = await reconcileStatuses(kernel, workspaceId, repairsOn);
+                    if (healed)
+                        kernel.log.info({ module: MODULE_ID, workspaceId, healed, repairsOn }, 'inventory: brought asset statuses back into step with the repairs capability');
+                    if (!repairsOn)
+                        return;
+                    const settings = await kernel.settings.module(workspaceId, MODULE_ID, InventorySettings);
+                    const cutoff = shiftDays(todayUtc(), -settings.repairOverdueDays);
+                    const late = await kernel.database.withWorkspace(workspaceId, (tx) => tx
+                        .select({
+                        id: repairs.id,
+                        assetId: repairs.assetId,
+                        summary: repairs.summary,
+                        vendor: repairs.vendor,
+                        sentOn: repairs.sentOn,
+                        createdBy: repairs.createdBy,
+                        code: assets.code,
+                        name: assets.name,
+                        custodianUserId: assets.custodianUserId,
+                    })
+                        .from(repairs)
+                        .innerJoin(assets, and(eq(assets.id, repairs.assetId), eq(assets.workspaceId, repairs.workspaceId)))
+                        .where(and(eq(repairs.workspaceId, workspaceId), isNull(repairs.returnedOn), isNull(repairs.overdueNotifiedAt), sql `${repairs.sentOn} <= ${cutoff}::date`))
+                        .orderBy(asc(repairs.sentOn))
+                        .limit(SWEEP_LIMIT));
+                    if (!late.length)
+                        return;
+                    let managers = null;
+                    const fallback = async () => {
+                        managers ??= await membersWithPermission(kernel, workspaceId, 'inventory.repair.manage');
+                        return managers;
+                    };
+                    let notified = 0;
+                    let unheard = 0;
+                    let undelivered = 0;
+                    for (const repair of late) {
+                        const named = [repair.createdBy, repair.custodianUserId].filter((id) => Boolean(id));
+                        const userIds = named.length ? named : await fallback();
+                        // Nobody to tell is not the same as told; see the warranty sweep above.
+                        if (!userIds.length) {
+                            unheard++;
+                            continue;
+                        }
+                        const delivered = await svc.notify.notify({
+                            workspaceId,
+                            userIds,
+                            type: 'inventory.repair.overdue',
+                            title: `${repair.code} has been away since ${readableDate(repair.sentOn)}`,
+                            body: repair.vendor ? `${repair.summary} · ${repair.vendor}` : repair.summary,
+                            object: { module: MODULE_ID, type: 'asset', id: repair.assetId },
+                            url: assetUrl(repair.assetId),
+                            groupKey: repair.id,
+                        });
+                        // Anybody left untold means nothing is marked: the same rule, and the same reason, as
+                        // the warranty sweep above spells out in full.
+                        if (delivered.delivered < delivered.targeted || !delivered.targeted) {
+                            undelivered++;
+                            continue;
+                        }
+                        await kernel.database.withWorkspace(workspaceId, (tx) => tx
+                            .update(repairs)
+                            .set({ overdueNotifiedAt: new Date() })
+                            .where(and(eq(repairs.workspaceId, workspaceId), eq(repairs.id, repair.id))));
+                        notified++;
+                    }
+                    if (unheard)
+                        kernel.log.warn({ module: MODULE_ID, workspaceId, silent: unheard }, 'inventory: repairs are overdue and nobody in the workspace may chase them');
+                    if (undelivered)
+                        kernel.log.warn({ module: MODULE_ID, workspaceId, undelivered }, 'inventory: overdue repair notices could not be delivered; they stay unmarked and go again tomorrow');
+                    if (notified)
+                        kernel.log.info({ module: MODULE_ID, workspaceId, notified }, 'inventory: repairs away longer than the workspace allows');
+                });
+            },
+        },
+    ];
+}
+//# sourceMappingURL=jobs.js.map

package/dist/server/jobs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jobs.js","sourceRoot":"","sources":["../../src/server/jobs.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,wFAAwF;AACxF,MAAM,WAAW,GAAG,GAAG,CAAA;AAEvB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,sGAAsG;AACtG,MAAM,QAAQ,GAAG,CAAC,KAAW,IAAI,IAAI,EAAE,EAAU,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAEjF,0CAA0C;AAC1C,SAAS,SAAS,CAAC,IAAY,EAAE,IAAY;IAC3C,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC,CAAA;IACvC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAA;IACnC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC7F,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAAc,EACd,GAAW,EACX,EAA0C;IAE1C,KAAK,MAAM,WAAW,IAAI,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YAAE,SAAQ;QACxF,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,WAAW,CAAC,CAAA;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,IAAI,CACb,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,EAC9F,iDAAiD,CAClD,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAU,CAAA;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,WAAmB,EACnB,SAAkB;IAElB,iGAAiG;IACjG,kGAAkG;IAClG,2CAA2C;IAC3C,MAAM,IAAI,GAAG,SAAS;QACpB,CAAC,CAAC,GAAG,CAAA,yBAAyB,OAAO;2BACd,OAAO,CAAC,WAAW,MAAM,MAAM,CAAC,WAAW;2BAC3C,OAAO,CAAC,OAAO,MAAM,MAAM,CAAC,EAAE;2BAC9B,OAAO,CAAC,UAAU,WAAW;QACpD,CAAC,CAAC,GAAG,CAAA,OAAO,CAAA;IACd,MAAM,OAAO,GAAG,GAAG,CAAA;aACR,IAAI;aACJ,MAAM,CAAC,eAAe;0BACT,CAAA;IAExB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CACnE,EAAE;SACC,MAAM,CAAC,MAAM,CAAC;SACd,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SAC/C,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EACnC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EACzB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAC7C,GAAG,CAAA,GAAG,MAAM,CAAC,MAAM,sBAAsB,OAAO,GAAG,CACpD,CACF;SACA,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAChC,CAAA;IACD,OAAO,IAAI,CAAC,MAAM,CAAA;AACpB,CAAC;AAED,0FAA0F;AAC1F,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE,CAC5C,IAAI,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE;IACxD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,SAAS;IACf,QAAQ,EAAE,KAAK;CAChB,CAAC,CAAA;AAEJ,MAAM,UAAU,aAAa;IAC3B,OAAO;QACL;YACE;;;;;;;;eAQG;YACH,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;gBACpC,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;gBACrC,MAAM,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;oBACrE,yFAAyF;oBACzF,uDAAuD;oBACvD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAA;oBACxF,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAA;oBACxB,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAA;oBAE7D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAClE,EAAE;yBACC,MAAM,CAAC;wBACN,EAAE,EAAE,MAAM,CAAC,EAAE;wBACb,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,aAAa,EAAE,MAAM,CAAC,aAAa;wBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;qBACxC,CAAC;yBACD,IAAI,CAAC,MAAM,CAAC;yBACZ,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EACnC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EACzB,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC;oBACjC,iFAAiF;oBACjF,yEAAyE;oBACzE,GAAG,CAAA,GAAG,MAAM,CAAC,aAAa;4BAChB,MAAM,CAAC,aAAa,OAAO,KAAK;4BAChC,MAAM,CAAC,aAAa,OAAO,OAAO,QAAQ,CACrD,CACF;yBACA,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;yBAClC,KAAK,CAAC,WAAW,CAAC,CACtB,CAAA;oBACD,IAAI,CAAC,GAAG,CAAC,MAAM;wBAAE,OAAM;oBAEvB,wFAAwF;oBACxF,uFAAuF;oBACvF,IAAI,QAAQ,GAAoB,IAAI,CAAA;oBACpC,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;wBAC1B,QAAQ,KAAK,MAAM,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAA;wBACvF,OAAO,QAAQ,CAAA;oBACjB,CAAC,CAAA;oBAED,IAAI,QAAQ,GAAG,CAAC,CAAA;oBAChB,IAAI,OAAO,GAAG,CAAC,CAAA;oBACf,IAAI,WAAW,GAAG,CAAC,CAAA;oBACnB,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;wBACxB,MAAM,OAAO,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAA;wBAClF;;;;;;;2BAOG;wBACH,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;4BACpB,OAAO,EAAE,CAAA;4BACT,SAAQ;wBACV,CAAC;wBAED,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;4BACxC,WAAW;4BACX,OAAO;4BACP,IAAI,EAAE,6BAA6B;4BACnC,iEAAiE;4BACjE,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,0BAA0B,YAAY,CAAC,KAAK,CAAC,aAAuB,CAAC,EAAE;4BAC3F,IAAI,EAAE,KAAK,CAAC,IAAI;4BAChB,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE;4BAC1D,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;4BACvB,QAAQ,EAAE,KAAK,CAAC,EAAE;yBACnB,CAAC,CAAA;wBAEF;;;;;;;;;;;;;;;;2BAgBG;wBACH,IAAI,SAAS,CAAC,SAAS,GAAG,SAAS,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;4BACpE,WAAW,EAAE,CAAA;4BACb,SAAQ;wBACV,CAAC;wBAED,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CACtD,EAAE;6BACC,MAAM,CAAC,MAAM,CAAC;6BACd,GAAG,CAAC,EAAE,kBAAkB,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;6BACvC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAC5E,CAAA;wBACD,QAAQ,EAAE,CAAA;oBACZ,CAAC;oBACD,IAAI,OAAO;wBACT,MAAM,CAAC,GAAG,CAAC,IAAI,CACb,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,EACnD,oFAAoF,CACrF,CAAA;oBACH,IAAI,WAAW;wBACb,MAAM,CAAC,GAAG,CAAC,IAAI,CACb,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,EAC/C,8FAA8F,CAC/F,CAAA;oBACH,IAAI,QAAQ;wBACV,MAAM,CAAC,GAAG,CAAC,IAAI,CACb,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,EAC5C,uCAAuC,CACxC,CAAA;gBACL,CAAC,CAAC,CAAA;YACJ,CAAC;SACF;QAED;YACE;;;;;;;;;;;;;;;eAeG;YACH,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;gBACpC,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;gBACrC,MAAM,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;oBACrE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;oBAC5D,MAAM,SAAS,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;oBAEnC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;oBACtE,IAAI,MAAM;wBACR,MAAM,CAAC,GAAG,CAAC,IAAI,CACb,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,EACrD,8EAA8E,CAC/E,CAAA;oBACH,IAAI,CAAC,SAAS;wBAAE,OAAM;oBAEtB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAA;oBACxF,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;oBAEjE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CACnE,EAAE;yBACC,MAAM,CAAC;wBACN,EAAE,EAAE,OAAO,CAAC,EAAE;wBACd,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,eAAe,EAAE,MAAM,CAAC,eAAe;qBACxC,CAAC;yBACD,IAAI,CAAC,OAAO,CAAC;yBACb,SAAS,CACR,MAAM,EACN,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CACjF;yBACA,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,EACpC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAC1B,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EACjC,GAAG,CAAA,GAAG,OAAO,CAAC,MAAM,OAAO,MAAM,QAAQ,CAC1C,CACF;yBACA,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;yBAC5B,KAAK,CAAC,WAAW,CAAC,CACtB,CAAA;oBACD,IAAI,CAAC,IAAI,CAAC,MAAM;wBAAE,OAAM;oBAExB,IAAI,QAAQ,GAAoB,IAAI,CAAA;oBACpC,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;wBAC1B,QAAQ,KAAK,MAAM,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAA;wBACxF,OAAO,QAAQ,CAAA;oBACjB,CAAC,CAAA;oBAED,IAAI,QAAQ,GAAG,CAAC,CAAA;oBAChB,IAAI,OAAO,GAAG,CAAC,CAAA;oBACf,IAAI,WAAW,GAAG,CAAC,CAAA;oBACnB,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;wBAC1B,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;wBAClG,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAA;wBACvD,wEAAwE;wBACxE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;4BACpB,OAAO,EAAE,CAAA;4BACT,SAAQ;wBACV,CAAC;wBAED,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;4BACxC,WAAW;4BACX,OAAO;4BACP,IAAI,EAAE,0BAA0B;4BAChC,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,wBAAwB,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;4BAC1E,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO;4BAC7E,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE;4BAChE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;4BAC7B,QAAQ,EAAE,MAAM,CAAC,EAAE;yBACpB,CAAC,CAAA;wBACF,sFAAsF;wBACtF,+CAA+C;wBAC/C,IAAI,SAAS,CAAC,SAAS,GAAG,SAAS,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;4BACpE,WAAW,EAAE,CAAA;4BACb,SAAQ;wBACV,CAAC;wBAED,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CACtD,EAAE;6BACC,MAAM,CAAC,OAAO,CAAC;6BACf,GAAG,CAAC,EAAE,iBAAiB,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;6BACtC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAC/E,CAAA;wBACD,QAAQ,EAAE,CAAA;oBACZ,CAAC;oBACD,IAAI,OAAO;wBACT,MAAM,CAAC,GAAG,CAAC,IAAI,CACb,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,EACnD,2EAA2E,CAC5E,CAAA;oBACH,IAAI,WAAW;wBACb,MAAM,CAAC,GAAG,CAAC,IAAI,CACb,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,EAC/C,oGAAoG,CACrG,CAAA;oBACH,IAAI,QAAQ;wBACV,MAAM,CAAC,GAAG,CAAC,IAAI,CACb,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,EAC5C,0DAA0D,CAC3D,CAAA;gBACL,CAAC,CAAC,CAAA;YACJ,CAAC;SACF;KACmC,CAAA;AACxC,CAAC"}